Stay ahead of what expires next.

Anything with an important date: passports and IDs, insurance, vehicle documents, warranties, subscriptions, trials, contracts, memberships, certifications, food, cosmetics, household items, pet-related dates, digital services and custom categories. A record can include a category/profile, issue/start date, primary date type, a per-item date-format override, up to 10 advance reminder intervals, related dates, cost/currency, recurrence, auto-renew status, issuer/provider, reference number, location, tags, notes, a renewal or account link, one primary photo, supporting attachments and lifecycle history.

The Library can be sorted by due date (soonest or latest first), name (A–Z), recently added or recently updated; the choice is remembered on the device and archived items always follow active ones. Select several items to act on them at once: Mark done, Move to category, Assign to profile or Delete. The Timeline includes a month calendar that marks the days with tracked dates, using distinct shapes as well as colours to show urgency; tap a day to see its items.

Deleted an item by mistake? Items disappear immediately and Undo stays available for about six seconds (longer with VoiceOver on iPhone/iPad, or when Android's accessibility settings ask for more time). After that, or when you leave the app, start an export or backup, or delete something else, the deletion is final.

Each item can store the web address where you renew, cancel or manage it — for example a subscription's account page. Only http and https addresses up to 2,048 characters are accepted. Open link in the item's details opens it in your browser; Expiry Pilot never visits or previews the link by itself. The link is included in backups, CSV, shared text and calendar exports.

The core scanner is on-device. iOS/iPadOS uses Apple's Vision text/barcode recognition and Android uses on-device ML Kit. Camera frames, images and PDFs are first analyzed locally; Android uses a temporary private PDF copy when rendering imported PDFs and deletes that copy after processing.

Product enrichment is separate from expiry detection: when a checksum-valid UPC/EAN/GTIN is eligible, Expiry Pilot may automatically look it up and only that retail code may be sent to Open Food Facts / Open Products Facts to request a product name/category. Arbitrary QR content and invalid retail codes are not eligible for this lookup.

The optional AI scan assistant is different: it is off by default. If you enable it, Expiry Pilot can send up to three downscaled JPEG scan pages (or one live-camera still) plus barcode/QR payloads already decoded on-device directly to the AI service you chose, using your own API key. See the next FAQ and the Privacy Policy for the exact behavior.

Local scans accept selected files up to 100 MB; for a PDF longer than 50 pages, the first 50 pages are scanned and the app tells you that only those were scanned. On Android, the live camera reads only the text inside the on-screen guide, so aim the guide at the date. The analyzer can use expiry wording in many languages, dates, passport and ID-card MRZ structures and conservative GS1 date fields to rank likely dates, and it ignores prices and weights that look like dates, but neither the local scanner nor the AI assistant saves a result automatically. You review and confirm before creating a record.

Open Settings → Security & privacy → AI scan assistant. It is available to free and Premium users. Choose ChatGPT (OpenAI), Claude (Anthropic), Grok (xAI), Gemini (Google), DeepSeek or OpenRouter, paste your own API key, and choose a preset or custom model ID. The key can be checked directly with the provider; Expiry Pilot does not run an AI proxy server.

The current built-in presets are GPT-6 Luna, GPT-6.1 Sol, GPT-6 Astra; Claude Haiku 5.5, Claude Sonnet 5.5, Claude Opus 5.5; Grok 4.7; Gemini 3.5 Flash-Lite, Gemini 3.8 Flash; DeepSeek V4.1 Flash (deepseek-flash); and, through OpenRouter, GPT-6 Luna (OpenAI), Claude Haiku 5.5 (Anthropic), Gemini 3.5 Flash-Lite (Google). Presets ask the model for a quick, low-effort reading where the service supports it. Custom model IDs are supported (OpenRouter uses the vendor/model form), but the selected model must accept image input for scan analysis.

OpenRouter lets one key reach models from several companies. It passes each scan on to the company that runs the model you chose; the privacy settings of your OpenRouter account decide which companies may receive your scans.

When enabled, imported photos/PDFs/document scans can be analyzed automatically after the on-device result, or you can turn Analyze automatically off and decide scan by scan. For the live camera, one still can be sent once the local scanner has locked on or when you tap Analyze with AI. The AI can propose the item name, category, date type, expiry/issue dates, issuer, reference, cost/currency and notes. High-confidence local dates and barcode-database product matches keep priority; a conflicting AI date is shown separately.

At most three JPEG scan pages, downscaled to a 1,568-pixel long edge, are sent for an AI request; a live-camera request sends one captured still. Barcode/QR payloads already decoded on-device can accompany the images and are marked to the model as untrusted data. If the service is briefly overloaded, unavailable or rate-limited, the request may be retried once automatically. Provider failures do not block the local scanner.

iOS stores each provider key in a separate device-only, non-synchronizing Keychain item. Android encrypts provider keys with a non-exportable Android Keystore key and stores the encrypted blobs in no-backup storage. Keys are not logged, exported or included in any Expiry Pilot backup. Each provider may apply its own availability, account rules, usage limits, charges, logging and retention.

OCR and barcode interpretation can be affected by image quality, language, unusual date formats or document layout. Expiry Pilot intentionally treats scan output as a suggestion. Verify important legal, travel, medical, insurance, contractual or safety-related deadlines with the relevant issuer or authority.

Each active tracked date can have up to 10 advance reminder days plus a final alert on the actual date. Snoozing creates a later reminder without changing the real expiration/due date. Primary-date notifications can offer Renew, Snooze 7d, Mark done and Open; items that renew automatically offer Renew, Snooze 7d and Open, and secondary dates intentionally do not offer whole-item completion. If a snooze would land on a day that already has a reminder for the same date, only one alert is shown.

For active items marked Automatically renews, the app can add a last-chance cancellation warning 1, 3, 7 or 14 days before the primary date, or turn it Off. The default is 7 days. If the chosen day is already a normal reminder lead, that reminder becomes the cancellation warning instead of creating a duplicate.

iOS/iPadOS: reminders use local notifications that follow your device's local time, so they keep their day and time when you travel, and Expiry Pilot keeps a rolling priority queue of up to 60 future requests. The final same-day alert is Time Sensitive, so it can break through Focus unless you use Quiet notifications or turn Time Sensitive notifications off in iOS Settings. Android: advance warnings use WorkManager; the final same-day alert can use an exact alarm when Alarms & reminders access is granted, with a duplicate-safe WorkManager fallback. A reminder missed while the phone was off or asleep is still delivered while it is the most timely one for that date, and a missed final alert gets one extra day. Schedules are reconciled after relevant reboot/time/time-zone/app-update/access changes. While App Lock is on, notifications never show item names. Notification permission and OS policies can still affect delivery.

They update the tracked item while adding an editable lifecycle-history record. Renew and Postpone move the primary date forward; Cancel archives the item as cancelled; Mark done archives it as completed and stops future reminders; Reactivate restores an archived item with today or a future date. History preserves the previous/resulting date and optional amount/note where applicable. Renewing also moves related dates (such as a cancel-by deadline) that fell on or before the old date, and monthly cycles keep their original billing day, so the 31st does not drift to the 28th.

Items marked Automatically renews move to their next cycle by themselves once their date has passed — by their recurrence, or yearly when none is set — with a Renewed automatically history entry, so a subscription that renews on its own is not left showing as expired. For these items Renew now comes first, and Mark done asks whether you want to stop tracking the subscription.

Recurring spend is a local summary built from active records that contain a positive cost. Items with an explicit recurrence are converted to monthly and yearly equivalents; an auto-renew item without an explicit interval is counted as yearly. One-off costs are shown separately instead of inflating recurring totals. Category totals are shown per currency. Upcoming (next 30 days) counts every charge projected in that period for repeating, auto-renewing and payment/renewal items — a monthly plan counts once per month — and leaves out one-off purchase prices. Expiry Pilot never performs exchange-rate conversion or combines different currencies.

Yes. Share creates a plain-text copy of one reminder with relevant fields such as date/type, category, provider/reference/location, recorded cost, recurrence, notes, additional dates and the renewal link. It is handed to the system share sheet; this is not Expiry Pilot cloud sync.

Add to Calendar prepares an all-day event for the tracked date. Android uses the system calendar insert flow and does not request calendar permission. iOS/iPadOS uses Apple's EventKit system editor so you can review the event and select a calendar before saving it.

Calendar (.ics) export writes a standard calendar file: Add to calendar (.ics) in an item's details exports that item, and Settings → Backup & export → Export calendar (.ics) exports all active items. Every tracked date becomes an all-day event with alarms matching up to five of the item's reminders at your reminder time, and the renewal link as the event URL. Each event keeps a stable identifier, so calendar apps that support updates refresh existing entries when you import a newer file. The file is a one-way copy: Expiry Pilot keeps reminding you as usual and never reads it back.

Both platforms have a Next Due home-screen widget that can show up to five upcoming active items when App Lock is off. iOS/iPadOS also provides App Shortcuts for quick Add, Scan and Next due actions. Android provides Add/Scan launcher shortcuts, can publish a context-sensitive Next due shortcut, and includes a Quick Settings scan tile.

These are app-owned device surfaces backed by local data. When App Lock is enabled, the current iOS and Android Next Due widgets suppress tracked-item content. Android also sanitizes the data-bearing Next Due shortcut and Quick Settings tile so they do not expose the tracked item while locked. Opening a shortcut/widget route still goes through the app's authentication gate when App Lock is active.

Yes. Both current apps include 20 app languages plus a Follow system option, System/Light/Dark appearance, and automatic or explicit DMY/MDY/YMD date formatting. A record can override the global date format without changing its stored date or reminders. Helpful tips, archive visibility, delete confirmation and App Lock are also configurable.

Portable backup: portable JSON v3 is the normal cross-platform transfer format between current iOS and Android builds. It can contain tracked records, categories, profiles, reminder lead times, saved locations, lifecycle history, normalized primary item photos and supporting attachments. The portable file is capped at 128 MB; primary photo payloads are capped at 5 MB per item and supporting attachments at 25 MB each. Embedded media is integrity-checked, private device-local paths are not exported, and import validates the complete backup before committing changes. Portable v1 and v2 backups remain importable.

Android complete backup: Android additionally exposes Export complete backup and writes a platform-specific ZIP container. Records and media are stored separately, so photos and attachments do not count toward the portable JSON 128 MB aggregate ceiling. Per-media safety limits still apply, and enough local storage is required to prepare/import it. Android normally writes portable v3 JSON; only bounded grandfathered metadata can cause the portable exporter to use its extended JSON v4 contract, which is not the normal cross-platform interchange path.

iOS/iPadOS large-backup fallback: iOS first creates portable JSON v3. If a valid library cannot fit the JSON/Base64 envelope, Export backup automatically creates a platform-specific binary v4 .epbackup file instead. Android complete ZIP and iOS .epbackup are different platform-specific formats; use a v3-compatible portable JSON file for Android↔iOS transfer.

Manual restore/import is additive: unrelated local records remain, exact portable duplicates are refreshed, and genuinely different records remain separate. Older versions of items you have since only renewed, postponed, completed, cancelled or reactivated are skipped instead of coming back as duplicates (items edited in other ways are kept as separate copies), and a photo already on the device is never replaced by an older one. Free users can import a backup file only when the resulting active library remains within 5 active items; archived items do not count. Premium removes that active-item limit.

CSV export includes active and archived items with Status, Repeats, Auto-renew, Issue date, Additional dates and Renewal link columns. It is UTF-8, and where your region writes decimals with a comma it uses semicolons between fields, so it is designed to open directly in spreadsheet apps such as Excel, and it does not include binary attachments.

iOS/iPadOS: Expiry Pilot's private app container can participate in Apple device/iCloud backup according to iOS backup behavior and your Apple settings. Android: the current Auto Backup/device-transfer rules are settings-only: only expiry_settings.xml is allowed. The Room database, records, normalized photos, attachments, AI-assistant state/keys and cloud-backup state are excluded from Android system backup/device transfer.

This is separate from Expiry Pilot's own optional encrypted Cloud backup feature described below.

Open Settings → Backup & export → Cloud backup. On iPhone/iPad, backups go to Expiry Pilot's private CloudKit storage in your iCloud account. On Android, you connect a Google account and the app uses only Google Drive's hidden appDataFolder scope. Expiry Pilot has no backup server.

The complete backup payload is encrypted on-device with AES-256-GCM before upload. The recovery key is also kept in the same cloud account so a replacement device using that account can restore.

Copies are kept per device, so a new or second device does not push out another device's latest backup. On Android, each device keeps its three newest copies, plus the newest copy of up to five other devices and the copy with the most items. On iPhone/iPad, the iCloud account holds three copies, protecting the newest copy, the copy with the most items and each other device's newest copy while the three slots allow; with three or more devices the oldest other device's copy can be replaced, but never the copy with the most items. The restore list shows which device made each copy. Before a device's first backup, if the cloud already holds a backup with more items, Expiry Pilot asks you to Restore first or Back up anyway instead of overwriting it.

Automatic backup is optional, runs only when data has changed and platform scheduling permits, checks roughly daily, and will not complete successful backups less than 12 hours apart. On Android it also confirms, at most every 20 hours, that this device's latest copy is still in Drive and backs up again if it is not. The Wi-Fi-only preference is on by default. If something needs your attention — sign-in, Premium, storage or a backup that is out of date — Settings and Home show it, and one notification (without item details) can open Cloud backup for you.

Creating a cloud backup — Automatic backup or Back up now — requires Premium. Listing, restoring and deleting existing cloud backups does not, and restoring a cloud backup is never limited by the free 5-active-item limit. Restore is additive and validates/decrypts the backup before changing local data. Delete cloud backups removes all cloud copies and the recovery key and turns automatic backup off without deleting data on the current device. On Android, your other devices using the same Google account then stop backing up automatically until you turn automatic backup on again on each of them. Cloud backups are tied to the platform/account used (iCloud on Apple devices, Google Drive on Android); use a v3-compatible portable JSON backup to move data between ecosystems.

App Lock uses the operating system's device-owner authentication. On iOS this can be Face ID, Touch ID or device passcode; on Android it can use supported biometrics or the device credential. Expiry Pilot receives only the authentication result and does not receive or store biometric templates. The app relocks after a genuine background transition.

App Lock is also enforced on app-owned external surfaces. The Next Due widget suppresses tracked-item content on both current platforms while locked. Android also sanitizes its context-sensitive Next Due shortcut and Quick Settings tile. While App Lock is on, reminder notifications use private wording without item names, whatever the notification-content setting says, and data-changing notification actions cannot bypass App Lock: iOS applies protected Snooze/Mark done actions only after you authenticate, while Android removes/fails closed on direct mutation actions when App Lock is enabled. On Android, the scanner camera stops while the lock screen is shown, and on Android 13 and later the recent-apps preview is hidden.

Premium does two things: it removes the 5-active-item limit (archived items do not count) and it enables creation of encrypted cloud backups, including Automatic backup and Back up now. Core scanning, the optional AI scan assistant, reminders, cancellation warnings, profiles/categories, photos/attachments, renewal links, lifecycle history and automatic renewal, the month calendar, sorting and bulk actions, recurring spend, share/calendar and calendar (.ics) export, widgets/quick actions, App Lock, manual backup/import and CSV export are available on the free tier within the active-item limit. Existing cloud backups can be listed, restored and deleted without Premium, and restoring a cloud backup is never limited by the free item limit.

The products are Lifetime Premium (one-time/non-consumable) and Annual Premium (auto-renewing yearly subscription). The App Store or Google Play supplies the current localized price and checkout terms. If Premium later ends, existing records remain accessible and existing cloud backups remain restorable; new active-item creation, file import or reactivation over the free limit and new cloud-backup creation remain unavailable until Premium is active again or the active-item count falls within the free limit.

iOS/iPadOS: open Premium and choose Restore purchases; StoreKit synchronizes and re-evaluates verified App Store entitlements for the current Apple ID. Android: Restore purchases re-queries Google Play for the Lifetime product and active Annual subscription. The apps keep bounded local entitlement state to avoid a false free state while verification starts; a successful store check is authoritative. Annual cached continuity is bounded to 72 hours.

Apple and Google purchases are separate. Expiry Pilot has no cross-platform account or entitlement server, so an App Store purchase does not become a Google Play entitlement or vice versa.

Expiry Pilot follows the normal OS permission model and cannot bypass device restrictions. Camera access is requested only for live scanning or when you explicitly choose Take photo for a tracked item. Notification access is used only for enabled reminders and the cloud-backup attention notice; authentication capability is used only by App Lock. On iPhone/iPad, if you set the app up by restoring or importing a backup, Expiry Pilot asks for notification access right after the restore if you have not decided yet.

Selecting an existing image/PDF/file uses platform system pickers rather than broad library/storage permission. Android Add to Calendar uses a calendar insert intent and does not request calendar permission. iOS/iPadOS uses the system EventKit editor only after you choose Add to Calendar; the app does not read Contacts directly, although the iOS 16 calendar editor may use Contacts while you review an event.

Delete individual items in the app to remove their records and, after the record change is safely saved at the end of the short Undo window, their private photos/attachments. Manual/cloud restore merges records and does not delete unrelated local items. Uninstalling/removing Expiry Pilot removes its private local app data, subject to any separate Apple system-backup copy.

Expiry Pilot cloud backups are separate from the installed app. Use Delete cloud backups to remove every stored cloud copy and its recovery key; uninstalling alone does not guarantee deletion of those cloud copies. Calendar files you exported, and events imported from them, remain in your files or calendar until you delete them there. Manual backup/CSV exports or files you shared/saved elsewhere remain there until you delete them. Data already sent to an AI provider (including OpenRouter and the company it forwarded the scan to) follows that provider's retention/deletion rules. Calendar events and App Store/Google Play purchase history also remain under their respective providers.